testing that user can not login with restricted account